Giacomo Vacca

Understanding WebRTC State Machines Specific transports, aggregate states, and the Chrome/libwebrtc mental model WebRTC is one of those technologies that appears deceptively simple on the surface. You call createOffer() , exchange some SDP, and suddenly two browsers are streaming video to each other. But beneath that simplicity lies a set of interlocking state machines that govern every aspect of the connection's lifecycle—from signaling and ICE candidate exchange to DTLS handshake completion. If you've ever stared at a WebRTC debugging log wondering why connectionState reads "connecting" while iceConnectionState says "connected" , this article is for you. The key insight, and the one the Chrome/libwebrtc codebase is built around, is that WebRTC state is organized into two distinct tiers: specific state machines that live on individual transports, and aggregate states on RTCPeerConnection that are derived—computed—from those transports. This art...

  Wireshark offers a simple but effective option to extend its capabilities, by using Lua dissectors . Just to give an example, recently received a pcap file containing some traffic (it was RTP) encapsulated inside a UDP header. The reason for encapsulation was transporting over a VPN. I'm in such a habit to look into RTP streams on Wireshark, that I have a setting that tells it to try an interpret any UDP packet automatically as carrying RTP ( I wrote how here ). That also failed. So Wireshark was not able to interpret those frames as RTP (or anything else, for what matters), and I remembered time ago writing a custom dissector. Wireshark allows to do that simply in Lua and add it as a plugin. The code is available here . I just had to make it available inside '$HOME/.local/lib/wireshark/plugins/`.

You’ve surely heard at least once in your life somebody saying “Calm down: it’s not a sprint, it’s a marathon”. People use this phrase to try and slow things down, but it misses the point. The first misconception is that a marathon is something you do slowly. A marathon is fast; it’s just as fast as possible for that athlete in that moment. Most people couldn’t hold an elite marathoner’s pace for even 100 meters. It’s a marathon, but it’s not slow. It’s easy to make a point that running a marathon is tough, not just for the distance but for the speed you try to keep. What’s maybe harder to see is that a marathon is much easier than many life challenges. You can simply prepare for a marathon. You get to the starting line with months or years of preparation. You tried progressively longer and tougher sessions, simulating the marathon effort. That’s a privilege. Many hurdles you’ll face in life will just appear in front of you while you were thinking of something else. A marathon has a fi...

If you have a pcap file with encrypted RTP (SDES SRTP) and have access to the SIP signalling to see the keys, these instructions will help you decrypt the RTP payload and save it as raw audio. Optionally, depending on the codec, you can then import the raw audio in Wireshark and save it as an audio file. Steps

Before I forget again, a Wireshark setting that can help saving time by trying to interpret any UDP as RTP, if possible: Analyze --> Enabled Protocols... --> Search for RTP and enable at least 'rtp_udp' Without that change, when SIP signalling is not present (or it's encrypted) Wireshark would not understand automatically that UDP packets may be RTP. This is particularly true for example for WebRTC calls, where signalling happens elsewhere and is not available to Wireshark. This will also save the reader some time if you're used to right click and 'Decode As...' to achieve the same.

Disclaimer: I wrote this article on March 2022 while working with Subspace, and the original link is here:  https://subspace.com/resources/ice-negotiation . This post in my personal blog is a way to ensure it doesn't get lost. There is nothing service-specific in it, I've made only minor edits and I hope it can be a good technical reference on the topic. WebRTC is a set of protocols that allow applications, typically running on Web browsers, to exchange media (audio, video, data) with other entities. Before media can flow, however, the WebRTC entities need to discover what type of connection is possible, and among the possible connections, what’s the best to be used. This needs to happen as fast as possible, so that users can perceive the service as instantaneous as possible. WebRTC includes protocols like STUN and TURN that are designed to facilitate the establishment of connections when a direct connection is not possible. The typical case is a computer inside a home or o...

  WebRTC applications use the ICE negotiation to discovery the best way to communicate with a remote party. I t dynamically finds a pair of candidates (IP address, port and transport, also known as “transport address”) suitable for exchanging media and data. The most important aspect of this is “dynamically”: a local and a remote transport address are found based on the network conditions at the time of establishing a session. For example, a WebRTC client that normally uses a server reflexive transport address to communicate with an SFU. when running inside the home office, may use a relay transport address over TCP when running inside an office network which limits remote UDP targets. The same configuration (defined as “iceServers” when creating an RTCPeerConnection will work in both cases, producing different outcomes.

 I'm a passionate runner, and always considered cycling as something fun, e.g. mountain-biking, but difficult to practice regularly. There's a lot of overhead in cycling, like the preparation, bike maintenance, dealing with city traffic, etc. Anyway about eight months ago I bought a road bike and felt in love with it. Soon after that I discovered Zwift and that gave an additional dimension to the sport: practice whenever you want from home, with accurate power measurements and a way to socialise with distant people. That was a game changer. In five months I cycled 1600 virtual Km and climbed almost 17 virtual Km. Meanwhile my running performance, instead of degrading, improved, and that surprised me. Anyway what I wanted to write about is a great article I read, "Physiological Differences Between Cycling and Running" . It's a review of articles published in that area. Some conclusions are very interesting. In general it seems sports medicine is still inconclusive...

 Since I needed to see a few details in the handling of attributes in STUN responses, I thought of going through the whole STUN protocol RFC again and take notes on the most important parts. I put my notes in some slides, and I'm sharing then in Slideshare in case somebody else may find them useful too: STUN protocol from Giacomo Vacca

I needed an efficient way to programmatically extract RTP streams from a network capture. In addition I wanted to: save each stream into a separate pcap file. extract SRTP-negotiated keys if present and available in the trace, associating them to the related RTP (or SRTP if the negotiation succeeded) stream. Some caveats: In normal conditions the negotiation of SRTP sessions happens via a secure transport, typically SIP over TLS, so the exchanged crypto information may not be available from a simple network capture. There are ways to extract RTP streams using Wireshark or tcpdump; it’s not necessary to do it programmatically. All this said I wrote a small tool ( https://github.com/giavac/pcap_tool ) that parses a network capture and tries to interpret each packet as either RTP/SRTP or SIP, and does two main things: save each detected RTP/SRTP stream into a dedicated pcap file, which name contains the related SSRC. print a summary of the crypto information exchanged, if available. With ...

It goes without saying that SIP solutions are impacted by NAT. So much that some scenarios required integration to RFC 3261 , e.g. with RFC 3581 , which defined the ' rport ' attribute to be added in the Via header (integrating the ' received ' attribute): with that information, responses could be routed to the source port of the related request, and not on the advertised port in the original Via. That was called Symmetric Response , and applied to connection-less transports (UDP), while, as mentioned in RFC 6314 , it's not necessary when using reliable transports (TCP in most cases): SIP responses can be sent back on the same connection on which the request arrived. Also from RFC 3261, chapter 18, Transport layer, client behaviour: "For reliable transports, the response is normally sent on the connection on which the request was received." But the client needs to be prepared to receive the response on a new connection: "[...] the transport layer MUST...

I'm sure I belong to the large group of people who love to analyse network traces with tools like Wireshark. Being able to see the details of a packet or datagram down to the level of the bits is not only extremely useful, but also fascinating. Time ago I wrote a dissector for Wireshark, using the Lua interface, and that was fun (I see it's still available here ). The official recommendation  is to use Lua only for prototyping and testing, but when performances are not key and there isn't the intent to add the dissector to the official distribution, it's fast and effective. In order to parse network traces with audio and extract it into the payload first, and then decode it into a WAV file, C is a viable solution. I wrote about a program that does that here and since it attracted some attention and feedback I wrote an updated version later . More recently I wanted to identify programmatically the presence (and value) of DTMF tones - as RTP Events, RFC 2833 - in network ...

There are many scenarios where an application running inside a Kubernetes environment may need to interact with its API. For example, an application running inside a Pod may need to retrieve real time information about the availability of other applications' endpoints. This may be a form of service discovery that integrates or extend the native Kubernetes internal service discovery. In most cases, DNS records are associated to a Service and provide the list of active Endpoints for that Service, with a proper TTL. There are situations though where those DNS records are not available, an application is not able to use them directly, or what's needed is more than the private IP addresses associated with the Endpoints. If interacting with the Kubernetes API from inside an application is needed, then there are two main areas to consider: Authentication and Authorisation. Every Pod has a Service Account associated to it, and applications running inside that Pod can use that Service A...

There are various levels of testing, from unit to component, from integration to end-to-end, not to mention performance testing and fuzzing. When developing or maintaining Real Time Communications (RTC or VoIP) systems,  all these levels (with the exclusion maybe of unit testing) are made easier by applications explicitly designed for this, like sipp . sipp has a deep focus on performance testing, or using a simpler term, load testing. Some of its features allow to fine tune properties like call rate, call duration, simulate packet loss, ramp up traffic, etc. In practical terms though once you have the flexibility to generate SIP signalling to negotiate sessions and RTP streams, you can use sipp for functional testing too. sipp can act as an entity generating a call, or receiving a call, which makes it suitable to surround the system under test and simulate its interactions with the real world. What sipp does can be generalised: we want to be able to simulate the real world tha...

Kamailio is an open source VoIP server, widely used in the VoIP industry for its performance and feature set. kamailio-tests is a project that aims to provide a level of automated testing for developers. The main idea is that simple things like loading a module or calling a core or module function can be tested without building an entire infrastructure around Kamailio. Also, we want to be able to perform the tests against various versions of Kamailio, and on various OS distributions. In this way a backward incompatible function or a regression can be discovered by a developer even though their system uses one single version and OS combination. This includes also third party libraries, e.g. you may think of testing the HTTP clients with different curl libraries, while Kamailio and OS stay at the same version. kamailio-test doesn't perform tests at function level (but it requires the application to run) or "integration testing" (because in order to re...